commit e54e1299404101a5a9d0cf5e45512b543967f958 Author: Mark Adler Date: Sat Sep 5 17:45:55 2015 -0700 Avoid shifts of negative values inflateMark(). The C standard says that bit shifts of negative integers is undefined. This casts to unsigned values to assure a known result. Upstream-Status: Backport http://http.debian.net/debian/pool/main/z/zlib/zlib_1.2.8.dfsg-5.debian.tar.xz https://github.com/madler/zlib/commit/e54e1299404101a5a9d0cf5e45512b543967f958 CVE: CVE-2016-9842 Signed-off-by: George McCollister diff --git a/inflate.c b/inflate.c index 2889e3a..a718416 100644 --- a/inflate.c +++ b/inflate.c @@ -1506,9 +1506,10 @@ z_streamp strm; { struct inflate_state FAR *state; - if (strm == Z_NULL || strm->state == Z_NULL) return -1L << 16; + if (strm == Z_NULL || strm->state == Z_NULL) + return (long)(((unsigned long)0 - 1) << 16); state = (struct inflate_state FAR *)strm->state; - return ((long)(state->back) << 16) + + return (long)(((unsigned long)((long)state->back)) << 16) + (state->mode == COPY ? state->length : (state->mode == MATCH ? state->was - state->length : 0)); }